Abandoned WordPress Plugins With Active User Bases: 390 Potential Acquisition Targets

Most Installed: Top 10

1. 01

   Limit Login Attempts

   1,194d inactive

   Automattic · 300K active installs · ★ 4.6

   300K sites are still running this plugin despite no updates for 1,194 days. No security patches have shipped in that period. Any vulnerability discovered today would remain unpatched indefinitely.

2. 02

   Layout Grid Block

   1,096d inactive

   Automattic · 200K active installs · ★ 4.7

   200K sites are still running this plugin despite no updates for 1,096 days. No security patches have shipped in that period. Any vulnerability discovered today would remain unpatched indefinitely.

3. 03

   PHP Compatibility Checker

   940d inactive

   WP Engine · 200K active installs · ★ 2.7

   200K sites are still running this plugin despite no updates for 940 days. No security patches have shipped in that period. Any vulnerability discovered today would remain unpatched indefinitely.

4. 04

   AddQuicktag

   1,878d inactive

   Frank Bueltge · 100K active installs · ★ 4.7

   100K sites are still running this plugin despite no updates for 1,878 days. No security patches have shipped in that period. Any vulnerability discovered today would remain unpatched indefinitely.

5. 05

   Easy Google Fonts

   1,814d inactive

   Sunny Johal · 100K active installs · ★ 4.6

   100K sites are still running this plugin despite no updates for 1,814 days. No security patches have shipped in that period. Any vulnerability discovered today would remain unpatched indefinitely.

6. 06

   WooSidebars

   829d inactive

   WooThemes · 100K active installs · ★ 3.9

   100K sites are still running this plugin despite no updates for 829 days. No security patches have shipped in that period. Any vulnerability discovered today would remain unpatched indefinitely.

7. 07

   WP Downgrade

   1,160d inactive

   Reisetiger · 100K active installs · ★ 4.8

   100K sites are still running this plugin despite no updates for 1,160 days. No security patches have shipped in that period. Any vulnerability discovered today would remain unpatched indefinitely.

8. 08

   BackUpWordPress

   808d inactive

   Tom Willmot · 90K active installs · ★ 4.7

   BackUpWordPress does exactly what its name suggests: it schedules automatic backups of a WordPress site's files and database, then stores those archives as zip files that a site owner can download or restore from. That simplicity is why Tom Willmot's plugin accumulated 90,000 active installs. Small business owners, freelancers managing client sites, and developers running lean stacks adopted it because it worked without requiring an external service or paid subscription. Those 90,000 sites are depending on it right now for their only recovery path. If BackUpWordPress stops functioning correctly after a WordPress core update, or gets exploited before a patch can ship, those sites lose their backup routine entirely and may have no restore point after a hack, accidental deletion, or failed update.

   797 days without a code update is a long time for a plugin that writes files to the server and reads database credentials. BackUpWordPress generates and stores zip archives in a predictable directory structure, which historically creates an unauthenticated file disclosure risk if the storage path is not properly protected. A disclosed CVE in this category could allow an attacker to download a full site backup containing the wp-config.php file, exposing database credentials, authentication keys, and salts in a single request. Arbitrary file access through an unprotected backup directory is the most realistic attack vector here, and it requires no authentication to exploit.

   The acquisition case for BackUpWordPress is genuinely strong, so the answer is yes. 90,000 installs in the backup category is a large base, and backup is a need that does not shrink. UpdraftPlus dominates WordPress.org in this space, but BackUpWordPress serves users who want a no-account, no-upsell tool, a segment with real loyalty. A developer willing to resolve the directory exposure risk and submit a security audit would inherit 90,000 installs with very low immediate churn risk. Interested developers typically contact the author via the WordPress.org plugin support forum.

9. 09

   Disable REST API

   1,031d inactive

   Dave McHale · 90K active installs · ★ 4.8

   Disable REST API gives site administrators a straightforward way to block unauthenticated access to the WordPress REST API, restricting endpoint exposure to logged-in users or disabling it outright. That simplicity explains the 90,000 active installs. The sites depending on it are typically membership platforms, private intranets, client portals, and any WordPress installation where exposing user data, post content, or custom endpoint responses to anonymous requests is unacceptable. If Disable REST API stops enforcing those restrictions, whether through a conflict introduced by a WordPress core update or a security gap in the plugin itself, those sites immediately revert to default WordPress behavior, meaning unauthenticated visitors can query the users endpoint and harvest login names, enumerate published content, and probe any registered REST route the site exposes.

   At 1,020 days without a code update, the specific risk for Disable REST API centers on REST API privilege escalation and authentication bypass. A plugin that intercepts and evaluates REST requests must correctly hook into WordPress permission callbacks on every route. A disclosed CVE here could allow an attacker to craft a request that satisfies the plugin's check superficially while bypassing the actual access control, granting read or write access to protected endpoints without valid credentials. On a membership site, that means extracting subscriber records. On a WooCommerce store, it means pulling order data or injecting content through the orders endpoint.

   Disable REST API is worth acquiring. The install base of 90,000 is large enough to justify maintenance investment, the use case is narrow and well-defined, and no actively maintained competitor with comparable install numbers exists on WordPress.org today. The plugin does one specific thing that a meaningful portion of WordPress operators genuinely need. Developers interested in acquiring Disable REST API can typically reach Dave McHale through the plugin's support forum on WordPress.org.

10. 10

    Facebook Chat Plugin

    1,467d inactive

    Facebook · 80K active installs · ★ 3.5

    Facebook Chat Plugin – Live Chat Plugin for WordPress embeds a Messenger chat widget directly into WordPress sites, letting visitors open a conversation with a Facebook Page inbox without leaving the browser tab. That frictionless contact point is why 80,000 sites still run it, mostly small e-commerce stores, service businesses, and local brands that treat Messenger as their primary customer support channel. If the plugin stops rendering correctly or gets disabled, those sites lose their only real-time contact option. If it gets exploited, an attacker could manipulate the widget output seen by every visitor, or interfere with the Page connection used to route incoming messages.

    At 1,456 days without an update, Facebook Chat Plugin – Live Chat Plugin for WordPress carries a meaningful risk profile. Plugins that handle third-party API tokens, specifically the Facebook Page access credentials used to authenticate the Messenger channel, are attractive targets because a stored XSS vulnerability in the settings panel could let a lower-privileged user inject script that exfiltrates those tokens. A disclosed CVE in this category would allow an attacker with contributor-level access to hijack the connected Facebook Page or redirect incoming customer conversations to an address they control.

    Facebook Chat Plugin – Live Chat Plugin for WordPress is worth acquiring. The 80,000 install base is sizeable, Messenger chat remains a genuinely popular category with no dominant well-maintained alternative on WordPress.org, and Meta's apparent disengagement from plugin maintenance leaves a real gap. Interested developers typically contact the author via the WordPress.org plugin support forum.